Time modifiers

Use time modifiers to customize the time range of a search or change the format of the timestamps in the search results.

_time and _indextime fields

When an event is processed by Splunk software, its timestamp is saved as the default field _time. This timestamp, which is the time when the event occurred, is saved in UNIX time notation. Searching with relative time modifiers, earliest or latest, finds every event with a timestamp beginning, ending, or between the specified timestamps.

For example, when you search for earliest=-4h, the search finds every event with a _time value in the last four hours.

You also have the option of searching for events based on when they were indexed. The UNIX time is saved in the _indextime field. Similar to earliest and latest for the _time field, you can use the relative time modifiers _index_earliest and _index_latest to search for events based on _indextime. For example, if you wanted to search for events indexed in the previous hour, use: _index_earliest=-h _index_latest=now().

Note: When using index-time based modifiers such as index_earliest and index_latest, your search must also have an event-time window which will retrieve the events. In other words, chunks of events might be ruled out based on the non index-time window as well as the index-time window. To be certain of retrieving every event based on index-time, you must run your search using All Time.

List of time modifiers

Use the earliest and latest modifiers to specify custom and relative time ranges. You can specify an exact time such as earliest="10/5/2016:20:00:00", or a relative time such as earliest=-h or latest=-15m.

When specifying relative time, you can use the now() modifier to refer to the current time.

Modifier

Syntax

Description

earliest

earliest=[+|-]<time_integer><time_unit>

Specify the earliest _time for the time range of your search.

_index_earliest

_index_earliest=[+|-]<time_integer><time_unit>

Specify the earliest _indextime for the time range of your search.

_index_latest

_index_latest=[+|-]<time_integer><time_unit>

Specify the latest _indextime for the time range of your search.

latest

latest=[+|-]<time_integer><time_unit>

Specify the latest time for the _time range of your search.

now

now()

Refers to the current time. If set to earliest, now() is the start of the search.

Comments

Please bring back the Timeformat command!! We upgraded to 6.5.2. I have several dashboards that use this command. The search in the dashboard still works, but I can't drill in to see the results. I can't use it in a search, I can't do testing. I get the following error message: Error in 'convert' command: The conversion type ' ' is invalid.

Cspires64

February 24, 2017

I believe that in 6.4.3 at least, the timeformat searchterm has died.
See my answer on this question here - https://answers.splunk.com/answers/448641/how-do-i-change-the-date-format-from-mmddyyyy-to-d.html#answer-448782

From what I can see on 6.4.3 on windows, timeformat="foo" in your searchterms, is accepted by Splunk without complaint, but it never has any affect. And I don't think there's any way any more *at all* for non-US users to get the old behavior of starttime="24/12/2015:00:00:00" endtime="25/12/2015:00:00:00" like you could when timeformat was working.

Sideview

September 8, 2016

I believe the 2nd example is false:

Example 2: To search events from the last full business week:

earliest=-7d@w1 latest=@w6

If we are Sunday for example, the earliest date is the Monday from the previous week and the latest date is the Saturday of the current week, so we search events for 2 full weeks of business, not 1.
I might be wrong, correct me please if necessary.

Couscousman

April 29, 2015

Thank you. These are great suggestions and will be submitted as enhancement requests.

Sophy

January 15, 2014

Personally, I'd like to see an option for a simper format (in addition to ISO). If I want 3 days of data from Jan 5, 2014 I'd love to be able to say:<br /><br /> earliest=01/05/2104 latest=+3d <br /> // default: midnight; <br /> // implied: 'latest' is relative to 'earliest' when "+" is used (since adding to 'now' is pointless)<br /><br />which is MUCH more friendly than my only option now:<br /><br /> earliest="01/05/2014:00:00:00" latest="01/08/2014:00:00:00"<br /><br />Furthermore: I often copy/paste queries into email. I'd like a way to convert relative times to literals so the query is still valid a week from now:<br /><br />earliest=-5d latest=+3d // used my "latest is relative to earliest" improvement<br /><br />somehow becomes <br />earliest="01/05/2014:10:11:12" latest="01/08/2014:10:11:12" <br /><br />so I can paste it accurately.

Zza2009

January 15, 2014

Yes. The timeformat used here is not scientific and confusing. I second the use of ISO format.

Mcae

August 9, 2013

if timeformat, starttime, and endtime are being deprecated, request that you use a different time format for earliest and latest. "2012-04-25T14:30:00-0500" (ISO 8601) perhaps? The existing format is incorrect for users outside the USA. 8601 is mostly supported by python

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »